ips collect-attack-evidence max-session-number
Function
The ips collect-attack-evidence max-session-number command sets the maximum number of attack evidence collection sessions for each IPS signature on each CPU.
The undo ips collect-attack-evidence max-session-number command restores the default maximum number of attack evidence collection sessions for each IPS signature on each CPU.
Format
ips collect-attack-evidence max-session-number session-number [ signature-id signature-id ]
undo ips collect-attack-evidence max-session-number [ signature-id signature-id ]
Parameters
| Parameter | Description | Value |
|---|---|---|
| session-number | Specifies the maximum number of attack evidence collection sessions. |
The value is an integer ranging from 0 to 50. The default value is 5. |
| signature-id signature-id | Specifies the ID of an IPS signature. |
The value is an integer ranging from 1025 to 16777215. |
Usage Guidelines
After the collect-attack-evidence enable command is executed, the device starts to collect the attack evidence that match the intrusion prevention profile. You can set the maximum number of sessions in which the device collects attack evidence that match the intrusion prevention profile for each IPS signature on each CPU to collect necessary information for packet tracing, with the impact on system performance controlled to the minimum extent. When the device provides multiple CPUs, the maximum number of attack evidence collection sessions for each IPS signature is the value of session-number multiplying the number of CPUs.
The device collects all packets in a matched session. This command specifies the maximum number of matched sessions, not the number of matched packets.
During the IPS signature database update, if the predefined signature for which the maximum number of attack evidence collection sessions is set does not exist in the IPS signature database, the corresponding configurations are reserved but do not take effect. When the current configurations are queried, the following message is displayed: Invalid configuration. The specified signature (signature-id) does not exist in the current library. Please check and delete it.
